Yeah. Fortunately though, in my case it’s a staff-only website - yes there are admin-only routes, but we can trust the staff - they’re already privy to the company IP, so I was aware of this limitation but happily ignored it for my current use-case!
But role-based protection might be nice for some people, so anyone who wants this - feel free to raise an issue in GH and I’ll look into it.
In this reply @jorgeer wrote:
Ideally we’d have something like
import("./some_module", { staffOnly: true })which placed the import in some restricted area at compile time and checked the logged in user’s isStaff flag when it was requested.
But that puts the {staffOnly: true} guard in the front-end code, so somehow the backend would have to parse all that to know what to allow or not. There might be some child components/packages which are lazily loaded on public routes as well as private routes, so they would have to be allowed. Could get tricky…